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In the claims: 
Claim 21 is canceled; 

Claims 1 , 20, and 22 are currently amended 
Claims 2-19 are original. 

1 . (Currently Amended) A method for detecting unauthorized use of a wireless local 
area network having at least one mobile unit that communicates with at least one access point, 
comprising: 

accumulating first network traffic data at a mobile unit; 

accumulating second network traffic data at an access point; 

communicating said first and second traffic data to a computer; and 

correlating said first and second traffic data in said computer to identify non-correlated 
traffic data indicative of unauthorized use of the wireless local area network and signaling an 
alarm condition when said non-correlated traffic data exceeds a threshold portion of said 
traffic data. 

2. (Original) A method as specified in claim 1 wherein said first traffic data includes 
number of transmitted messages for said mobile unit. 

3. (Original) A method as specified in claim 2 wherein said first traffic data includes 
destination address of said transmitted messages. 

4. (Original) A method as specified in claim 1 wherein said first traffic data includes 
number of received messages for said mobile unit. 

5. (Original) A method as specified in claim 4 wherein said first traffic data includes 
source address of said received messages. 
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6. (Original) A method as specified in claim 1 wherein said first traffic data includes a 
record of association requests of said mobile unit with said access point. 

7. (Original) A method as specified in claim 1 wherein said first traffic data includes a 
record of disassociation transactions. 

8. (Original) A method as specified in claim 1 wherein said first traffic data includes 
number of broadcast and multicast frames received by said mobile unit. 

9. (Original) A method as specified in claim 1 wherein said first traffic data includes a 
record of authentication requests. 

10. (Original) A method as specified in claim 1 wherein said second traffic data 
includes number of transmitted messages for said access point. 

1 1 . (Original) A method as specified in claim 10 wherein said second traffic data 
includes destination address of said transmitted messages. 

12. (Original) A method as specified in claim 1 wherein said second traffic data 
includes number of received messages for said access point. 

13. (Original) A method as specified in claim 10 wherein said second traffic data 
includes source address of said received messages. 

14. (Original) A method as specified in claim 1 wherein said second traffic data 
includes a record of association requests of mobile units with said access point. 

15. (Original) A method as specified in claim 1 wherein said second traffic data 
includes a record of disassociation transactions. 

16. (Original) A method as specified in claim 1 wherein said second traffic data 
includes number of broadcast and multicast frames sent by said access point. 
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17. (Original) A method as specified in claim 1 wherein said second traffic data 
includes a record of authentication requests. 

18. (Original) A method as specified in claim 1 wherein said communicating said 
traffic data to a computer is repeated on a periodic basis. 

19. (Original) A method as specified in claim 1 wherein said communicating said 
traffic data to a computer is in response to a command signal from said computer. 

20. (Currently Amended) A method for detecting unauthorized use of a wireless local 
area network having at least two mobile units that communicate with at least one access point, 
comprising: 

accumulating first network traffic data at a first mobile unit; 

accumulating second network traffic data at a second mobile unit; 

communicating said first and second traffic data to a computer; and 

correlating said first and second traffic data in said computer to identify non-correlated 
traffic data indicative of unauthorized use of the wireless local area network and signaling an 
alarm condition when said non-correlated traffic data exceeds a threshold portion of said 
traffic data. 

21. (Canceled) 

22. (Currently Amended) A system for detecting unauthorized use of a wireless local 
area network, comprising: 

at least one mobile unit; 

at least one access point; and 

at least one server computer, 
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wherein first network traffic data is accumulated by said at least one mobile unit, 
second network traffic data is accumulated by said at least one access point, said first and 
second network traffic data are communicated to said at least one server computer, said first 
and second network traffic data are correlated by said at least one server computer to identify 
non-correlated traffic data indicative of unauthorized use of the wireless local area network , 
and an alarm condition is signaled when said non-correlated traffic data exceeds a threshold. 
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